Skip to main content
protocols.pageprotocols.page
9091

Port 9091 – Transmission / Prometheus Pushgateway

TCP

Port 9091 is shared by Transmission BitTorrent web UI and Prometheus Pushgateway. Transmission on 9091 provides torrent management via browser. Pushgateway on 9091 accepts metrics from batch jobs. Both require authentication – Pushgateway without auth allows metric injection that corrupts monitoring and triggers false alerts.

Port Number

9091

Protocol

TCP

Service

Transmission Web UI / Pushgateway

Range

IANA Registered (1024–49151)

Description

Port 9091 serves two common applications. Transmission (BitTorrent client) runs its web interface and RPC API on port 9091 for remote torrent management. Prometheus Pushgateway also defaults to port 9091, accepting metric pushes from short-lived batch jobs that cannot be scraped. Transmission's web UI has built-in username/password auth (settings.json: rpc-authentication-required). Pushgateway has no built-in authentication – any client that can reach port 9091 can push arbitrary metrics. Malicious metric injection into Pushgateway can trigger alert rules, hide real problems, or manipulate dashboards. Place Pushgateway behind a reverse proxy with basic auth or network-level restriction.

Security risks

  • 1CVE-2018-5702: Transmission RPC DNS rebinding RCE – a malicious website can exploit DNS rebinding to send RPC commands to Transmission on localhost:9091, triggering arbitrary file downloads to attacker-chosen paths. Exploitable from any browser visiting a malicious page. Fixed in Transmission 2.93+.
  • 2Pushgateway has zero authentication: any network-adjacent client can POST metrics to /metrics/job/<name>, injecting arbitrary metric values. Attacker injects node_memory_MemAvailable_bytes=0 → triggers OOM alerts → operator escalation on a healthy system.
  • 3Pushgateway metric deletion: DELETE /metrics/job/<name> removes all metrics for a job group. Attacker silently deletes metrics for a failing service → monitoring blind spot → undetected outage.
  • 4Transmission default config binds to all interfaces (rpc-bind-address: 0.0.0.0) – combined with weak/no password, gives remote torrent control and arbitrary file download/upload capability.
  • 5Alert rule manipulation via Pushgateway: inject metrics that satisfy alert-suppression rules (e.g., push up{instance='critical-service'}=1 to silence 'service down' alerts while the service is actually dead).

Firewall guidance

For Transmission: bind to localhost only (rpc-bind-address: 127.0.0.1 in settings.json), enable rpc-authentication-required with a strong password, and set rpc-whitelist to specific IPs. For Pushgateway: deploy behind nginx with basic auth or restrict to Prometheus server + batch job IPs via firewall. In Kubernetes, use NetworkPolicy to allow Pushgateway access only from batch job namespaces.

Diagnosis commands

Test if Transmission RPC is responding (409 = needs session header, 401 = auth required)

shell
curl -s http://localhost:9091/transmission/rpc -o /dev/null -w '%{http_code}'

Test if Pushgateway is responding and see pushed metrics

shell
curl -s http://localhost:9091/metrics | head -10

Pushgateway: list all job labels that have pushed metrics (detect unauthorized pushers)

shell
curl -s http://localhost:9091/api/v1/metrics | jq '.[] | .labels.job' | sort -u

Identify which service owns port 9091 (Transmission vs Pushgateway)

shell
ss -tnlp sport = :9091

Usage examples

Port 9091 – Transmission / Prometheus Pushgateway
shell
transmission-remote localhost:9091 -l (list torrents)
curl -X POST http://pushgateway:9091/metrics/job/batch -d 'metric 42'
curl http://pushgateway:9091/metrics (view pushed metrics)

Common services on this port

Transmission BitTorrent daemonPrometheus Pushgatewaytransmission-daemon (headless)transmission-gtk/qt (with web UI enabled)

Related ports

9090

Prometheus server

51413

Transmission peer port (BitTorrent)

9093

Alertmanager (receives alerts from manipulated metrics)

History

Transmission has used port 9091 for its RPC/web interface since version 1.30 (2008). Prometheus Pushgateway adopted the same port (configurable via --web.listen-address) when first released in 2014. The collision means identifying which service runs on 9091 requires checking the HTTP response. Transmission's DNS rebinding vulnerability (2018) was notable because it proved local-only services are not safe from web-based attacks.

FAQ

How do I tell if port 9091 is Transmission or Pushgateway?

curl http://localhost:9091/ – Transmission returns a redirect to /transmission/web/ or a 409 with X-Transmission-Session-Id header. Pushgateway returns an HTML page with 'Prometheus Pushgateway' title and a /metrics link. Alternatively: ss -tnlp sport = :9091 shows the process name.

How do I add authentication to Prometheus Pushgateway?

Pushgateway has no built-in auth. Options: (1) nginx reverse proxy with basic_auth (simplest), (2) oauth2-proxy sidecar in Kubernetes, (3) --web.config.file with TLS and basic_auth (Pushgateway 1.5+ supports web.yml like Prometheus). Also restrict at network level – only batch job hosts and Prometheus should reach 9091.